Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-07T05:18:57.427Z",
  "pubdate": "2026-11-07T05:18:57.427Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in IBM API Connect, affecting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\nThe vulnerability arises due to insufficient validation of address-based controls, allowing a remote authenticated attacker to bypass intended access restrictions.\nBy manipulating requests processed by the server, an attacker can coerce the application into making unauthorized requests to internal resources or external destinations that are typically blocked by security policies.\nThis flaw facilitates the exfiltration of sensitive information or the interaction with internal services that should not be accessible from the network perimeter.\nThe impact includes the exposure of internal infrastructure topology, sensitive configuration data, or private service credentials.\nSuccessful exploitation requires the attacker to be authenticated to the platform, after which they can leverage the server's identity to traverse internal network segments.\nThis vulnerability highlights a significant failure in the application's request validation logic, posing a critical risk to the confidentiality of backend systems managed by the API Connect platform.",
  "technicalDetails": "The vulnerability is rooted in an improper implementation of address-check logic within the request-handling framework of IBM API Connect. Specifically, the component responsible for processing outbound requests fails to strictly enforce blocklist or allowlist configurations against user-supplied destinations.\nThe attack flow commences with the attacker providing a crafted payload to an input vector that triggers an outbound request from the API Connect server. Because the application logic fails to perform robust URL validation or sanitize the target address before execution, the server-side proxy component processes the request blindly.\nBy manipulating the destination URI, an attacker can bypass the intended security policy designed to restrict server-side interactions. This allows the server to act as a proxy, sending requests to prohibited internal network nodes, such as private APIs, metadata services (e.g., cloud instance metadata endpoints), or internal administration panels residing on non-routable IP spaces.\nThe exploitation process does not require high-privileged access beyond initial authentication, meaning an authenticated user with standard privileges can abuse this functionality to escalate their reach within the internal environment. The technical constraint is the bypass of the application's internal filtering mechanism; once the filter is circumvented, the attacker can leverage the server's local network trust to interact with services that lack further authentication requirements.\nPost-exploitation, the server-side response is typically reflected back to the attacker or cached in a way that allows for the retrieval of response bodies. This enables the attacker to perform reconnaissance on internal network topology, intercept sensitive tokens, or exfiltrate metadata that would otherwise be shielded by the network perimeter.\nThe affected versions, specifically 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2, maintain this insecure request-handling logic in the request proxy module, which fails to neutralize malicious inputs designed to redirect internal HTTP requests. The absence of strict input validation at the application layer permits the abuse of the proxy functionality, effectively turning the product into a vehicle for unauthorized SSRF attacks against local and internal networked infrastructure."
}